Rename the project to ihasvpn

WGX shares its name with several other WireGuard tools, so the project
becomes ihasvpn, alongside ihasmail.

- Module github.com/Coffey-Labs/ihasvpn, command cmd/ihasvpn, image
  ghcr.io/coffey-labs/ihasvpn.
- Environment variables move from WGX_* to IHASVPN_*. The default database
  is ihasvpn.db, the nftables table is `ihasvpn`, metrics are ihasvpn_*, and
  the session cookie and theme key are renamed, so existing sessions end.
- The mark is the ihasmail cat peeking over the edge of a shield, drawn as
  a vector. docs/brand/generate.py builds the mark, mono mark, wordmarks,
  social card, favicons and app icons from that one drawing.
- The console takes ihasmail's palette: the ihasmail.org teal-navy for dark,
  its contrast-checked light tiers with the site's light accent, received
  traffic in the cat's orange and sent in teal. The wordmark weight and
  font stack follow ihasmail.org.
- Detail values wrap at spaces before breaking inside an address, so an
  IPv6 tunnel address no longer splits mid-number.
- The README history note about the earlier WGX installer is gone with the
  name it explained. Screenshots retaken.

SECURITY.md

@@ -12,7 +12,7 @@ patched.
 you think the impact is. You will get an acknowledgement within a few days
 and a fix or a plan before anything is made public.
 
-## What WGX does to protect itself
+## What ihasvpn does to protect itself
 
 - The admin UI requires a password (argon2id, 64 MiB, 3 passes) and offers
   time-based one-time codes with recovery codes. Sessions are random 256-bit
@@ -36,8 +36,8 @@ and a fix or a plan before anything is made public.
 ## What you must do
 
 - Do not expose port 51821 to the internet without TLS. Either set
-  `WGX_TLS_SELF_SIGNED=true` (or `WGX_TLS_CERT`/`WGX_TLS_KEY`) or put a
+  `IHASVPN_TLS_SELF_SIGNED=true` (or `IHASVPN_TLS_CERT`/`IHASVPN_TLS_KEY`) or put a
   TLS-terminating reverse proxy in front and list it in
-  `WGX_TRUSTED_PROXIES` so client addresses in the audit log are right.
+  `IHASVPN_TRUSTED_PROXIES` so client addresses in the audit log are right.
 - Turn on two-factor authentication for every administrator.
 - Keep the `/data` volume private: it holds every peer's private key.